Is that password sent anywhere or is it just used on client side decryption?